Merge pull request #840 from betrusted-io/ux

Add progress bar to loader on baosec targets

Author: bunnie

libs/bao1x-hal/src/sh1107.rs

@@ -14,6 +14,9 @@ pub const PAGE: u8 = ROW as u8 / 8;
 // IFRAM space reserved for UDMA channel commands
 const SIDEBAND_LEN: usize = 256;
 
+// 0x4f is a bit too bright
+pub const DEFAULT_BRIGHTNESS: u8 = 0x3f;
+
 pub struct MainThreadToken(());
 impl MainThreadToken {
     pub fn new() -> Self { MainThreadToken(()) }
@@ -465,7 +468,7 @@ impl<'a> Oled128x128<'a> {
             SetDCDCSettings(0x0),
             SetStartLine(0),
             SetDisplayOffset(0),
-            SetContrastControl(0x3f), // was 0x4f, was a bit too bright
+            SetContrastControl(DEFAULT_BRIGHTNESS),
             SetAddressMode(AddressMode::Column),
             SetSegmentReMap(false),
             SetCOMScanDirection(Direction::Inverted),
@@ -512,6 +515,61 @@ impl<'a> Oled128x128<'a> {
         crate::board::assert_periph_reset(self.iox, false);
         self.powerdown = false;
     }
+
+    pub fn brightness(&mut self, level: u8) {
+        let bytes = Command::SetContrastControl(level).encode();
+        self.send_command(bytes);
+    }
+
+    #[cfg(feature = "std")]
+    pub fn render_bitmap(&mut self, bitmap: ux_api::service::api::BaosecBitmap) {
+        const W: isize = WIDTH as _;
+        const H: isize = LINES as _;
+
+        // Clamp bounding box to valid bitmap dimensions.
+        // If br > 128, truncate. If tl < 0, clamp to 0.
+        let src_x0 = bitmap.bounding_box.tl.x.max(0);
+        let src_y0 = bitmap.bounding_box.tl.y.max(0);
+        let src_x1 = bitmap.bounding_box.br.x.min(W);
+        let src_y1 = bitmap.bounding_box.br.y.min(H);
+
+        for src_y in src_y0..src_y1 {
+            // Map this bitmap row to its destination row in the framebuffer.
+            let dst_y = src_y + bitmap.top_left.y;
+
+            // Skip rows that land outside the framebuffer.
+            if dst_y < 0 || dst_y >= H {
+                continue;
+            }
+
+            for src_x in src_x0..src_x1 {
+                // Map this bitmap column to its destination column.
+                let dst_x = src_x + bitmap.top_left.x;
+
+                // Skip columns that land outside the framebuffer.
+                if dst_x < 0 || dst_x >= W {
+                    continue;
+                }
+
+                // --- read source bit ---
+                let src_linear = (src_x + src_y * W) as usize;
+                let src_word = src_linear >> 5; // / 32
+                let src_shift = src_linear & 0x1F; // % 32
+                let on = (bitmap.bits[src_word] >> src_shift) & 1;
+
+                // --- write destination bit ---
+                let dst_linear = (dst_x + dst_y * W) as usize;
+                let dst_word = dst_linear >> 5;
+                let dst_shift = dst_linear & 0x1F;
+
+                if on != 0 {
+                    self.buffer[dst_word] |= 1 << dst_shift;
+                } else {
+                    self.buffer[dst_word] &= !(1 << dst_shift);
+                }
+            }
+        }
+    }
 }
 
 impl<'a> FrameBuffer for Oled128x128<'a> {

libs/keystore-api/src/gen2_api.rs

@@ -21,6 +21,7 @@ pub enum Opcode {
     // ----- below are non-cryptographic opcodes but used to manipulate sensitive state -----
     /// Set bootwait parameters
     Bootwait = 4096,
+    IsDeveloper = 4097,
 
     /// Used to map unknown opcodes
     InvalidCall = 65535,

libs/ux-api/src/minigfx/mod.rs

@@ -36,7 +36,7 @@ use crate::platform;
 /// Abstract trait for a FrameBuffer. Slower than native manipulation
 /// of the [u8] contents of a frame buffer, but more portable.
 pub trait FrameBuffer {
-    /// Puts a pixel of ColorNative at x, y. (0, 0) is defined as the lower left corner.
+    /// Puts a pixel of ColorNative at x, y. (0, 0) is defined as the top left corner.
     fn put_pixel(&mut self, p: Point, color: ColorNative);
     /// For higher-performance loops that have guaranteed bounds checking in the point location.
     unsafe fn put_pixel_unchecked(&mut self, p: Point, on: ColorNative);
@@ -56,6 +56,27 @@ pub trait FrameBuffer {
     unsafe fn raw_mut(&mut self) -> &mut platform::FbRaw;
 }
 
+// Newtype wrapping the FrameBuffer, to allow for sized passing of the object around
+pub struct DynFb<'a>(pub &'a mut dyn FrameBuffer);
+
+impl FrameBuffer for DynFb<'_> {
+    fn put_pixel(&mut self, p: Point, c: ColorNative) { self.0.put_pixel(p, c) }
+
+    fn xor_pixel(&mut self, p: Point) { self.0.xor_pixel(p) }
+
+    unsafe fn put_pixel_unchecked(&mut self, p: Point, on: ColorNative) { self.0.put_pixel_unchecked(p, on); }
+
+    fn get_pixel(&self, p: Point) -> Option<ColorNative> { self.0.get_pixel(p) }
+
+    fn draw(&mut self) { self.0.draw(); }
+
+    fn clear(&mut self) { self.0.clear(); }
+
+    fn dimensions(&self) -> Point { self.0.dimensions() }
+
+    unsafe fn raw_mut(&mut self) -> &mut platform::FbRaw { self.0.raw_mut() }
+}
+
 /// A TypesetWord is a Word that has beet turned into sprites and placed at a specific location on the canvas,
 /// defined by its `bb` record. The intention is that this abstract representation can be passed directly to
 /// a rasterizer for rendering.

libs/ux-api/src/service/api.rs

@@ -107,6 +107,11 @@ pub enum GfxOpcode {
     PowerDown,
     #[cfg(feature = "board-baosec")]
     PowerUp,
+    #[cfg(feature = "board-baosec")]
+    /// This call is specific and highly optimized to the display on Baosec
+    BaosecBitmap,
+    #[cfg(feature = "board-baosec")]
+    Brightness,
 
     /// Gutter for invalid calls
     InvalidCall,
@@ -154,3 +159,14 @@ pub struct KeyboardRegistration {
     pub server_name: String,
     pub listener_op_id: usize,
 }
+
+#[cfg(feature = "board-baosec")]
+#[derive(Debug, rkyv::Archive, rkyv::Serialize, rkyv::Deserialize, Clone)]
+pub struct BaosecBitmap {
+    // exactly enough for a 128x128 black and white display = 2048 bytes
+    pub bits: [u32; 512],
+    // top left corner of the bitmap
+    pub top_left: crate::minigfx::Point,
+    // bounding box of the bitmap - if we want only a portion of the bitmap to be drawn
+    pub bounding_box: crate::minigfx::Rectangle,
+}

libs/ux-api/src/service/gfx.rs

@@ -769,6 +769,38 @@ impl Gfx {
         }
     }
 
+    #[cfg(feature = "board-baosec")]
+    pub fn bitmap(
+        &self,
+        bitmap: &[u32],
+        top_left: Option<Point>,
+        bounding_box: Option<Rectangle>,
+    ) -> Result<(), xous::Error> {
+        let mut bmp = BaosecBitmap {
+            bits: [0u32; 512],
+            top_left: top_left.unwrap_or(Point::new(0, 0)),
+            bounding_box: bounding_box.unwrap_or(Rectangle {
+                tl: Point::new(0, 0),
+                // br is *exclusive*
+                br: Point::new(128, 128),
+                style: DrawStyle { fill_color: None, stroke_color: None, stroke_width: 0 },
+            }),
+        };
+        bmp.bits[..bitmap.len().min(512)].copy_from_slice(&bitmap[..bitmap.len().min(512)]);
+        let mut buf = Buffer::into_buf(bmp).unwrap();
+        buf.lend_mut(self.conn, GfxOpcode::BaosecBitmap.to_u32().unwrap())?;
+        Ok(())
+    }
+
+    #[cfg(feature = "board-baosec")]
+    pub fn brightness(&self, level: u8) -> Result<(), xous::Error> {
+        send_message(
+            self.conn,
+            Message::new_blocking_scalar(GfxOpcode::Brightness.to_usize().unwrap(), level as usize, 0, 0, 0),
+        )
+        .map(|_| ())
+    }
+
     #[cfg(feature = "hosted-baosec")]
     pub fn acquire_qr(&self) -> Result<QrAcquisition, xous::Error> {
         let dummy = "otpauth://totp/ACME%20Co:john.doe@email.com?secret=HXDMVJECJJWSRB3HWIZR4IFUGFTMXBOZ&issuer=ACME%20Co&algorithm=SHA1&digits=6&period=30".to_string();

loader/src/lib.rs

@@ -43,12 +43,12 @@ pub const APP_UART_IFRAM_ADDR: usize = bao1x_hal::board::APP_UART_IFRAM_ADDR;
 pub const GUARD_MEMORY_BYTES: usize = 3 * crate::PAGE_SIZE;
 /// Amount of space for loader stack only, with swap
 #[cfg(all(feature = "swap", not(feature = "resume"), not(feature = "bao1x")))]
-pub const GUARD_MEMORY_BYTES: usize = 7 * crate::PAGE_SIZE;
+pub const GUARD_MEMORY_BYTES: usize = 8 * crate::PAGE_SIZE;
 #[cfg(all(feature = "swap", not(feature = "resume"), feature = "bao1x"))]
-pub const GUARD_MEMORY_BYTES: usize = 7 * crate::PAGE_SIZE;
-/// Amount of space for loader stack plus clean suspend, with swap
+pub const GUARD_MEMORY_BYTES: usize = 8 * crate::PAGE_SIZE;
+/// Amount of space for loader stack plus clean suspend, with swap. +1 page cost for the loading bar graphics
 #[cfg(all(feature = "swap", feature = "resume"))]
-pub const GUARD_MEMORY_BYTES: usize = 8 * crate::PAGE_SIZE; // 1 extra page for clean suspend
+pub const GUARD_MEMORY_BYTES: usize = 9 * crate::PAGE_SIZE; // 1 extra page for clean suspend
 
 #[cfg(feature = "swap")]
 pub const SWAPPER_PID: u8 = 2;

loader/src/main.rs

@@ -470,6 +470,15 @@ fn boot_sequence(
     _perclk_freq: u32,
     detached_app: bool,
 ) -> ! {
+    #[cfg(feature = "board-baosec")]
+    let mut iox = bao1x_hal::iox::Iox::new(utralib::utra::iox::HW_IOX_BASE as *mut u32);
+    #[cfg(feature = "board-baosec")]
+    let mut udma_global = bao1x_hal::udma::GlobalConfig::new();
+    #[cfg(feature = "board-baosec")]
+    let mut oled = crate::platform::oled_init(&mut iox, &mut udma_global, _perclk_freq);
+    #[cfg(feature = "board-baosec")]
+    crate::platform::progress_bar(&mut oled, 0);
+
     // Store the initial boot config on the stack.  We don't know
     // where in heap this memory will go.
     #[allow(clippy::cast_ptr_alignment)] // This test only works on 32-bit systems
@@ -525,8 +534,19 @@ fn boot_sequence(
         // cold boot path
         println!("No suspend marker found, doing a cold boot!");
         clear_ram(&mut cfg);
-        phase_1(&mut cfg, detached_app);
-        phase_2(&mut cfg, env_variables);
+
+        #[cfg(feature = "board-baosec")]
+        {
+            phase_1(&mut cfg, detached_app, Some(&mut oled));
+            phase_2(&mut cfg, env_variables, Some(&mut oled));
+            crate::platform::progress_bar(&mut oled, 100);
+        }
+        #[cfg(not(feature = "board-baosec"))]
+        {
+            phase_1(&mut cfg, detached_app, None);
+            phase_2(&mut cfg, env_variables, None);
+        }
+
         #[cfg(any(feature = "debug-print", feature = "swap"))]
         if VDBG || SDBG {
             check_load(&mut cfg);

loader/src/minielf.rs

@@ -92,6 +92,7 @@ impl MiniElf {
         let mut current_page_addr: usize = 0;
         let mut previous_addr: usize = 0;
         let mut last_mapped_xip = 0;
+        #[cfg(feature = "swap")]
         let mut last_mapped_swap_virt = 0; // track the last virtual address mapped to swap, to catch gaps
         let image_phys_base = allocator.base_addr as usize + self.load_offset as usize;
         // It is a requirement that the image generator lay out the artifacts on disk such that

loader/src/phase1.rs

@@ -1,8 +1,14 @@
 use core::{mem::size_of, slice};
 
+#[cfg(any(feature = "board-baosec", feature = "board-baosor"))]
+use ux_api::minigfx::FrameBuffer;
+
 #[cfg(feature = "atsama5d27")]
 pub use crate::platform::atsama5d27::load::InitialProcess;
 use crate::*;
+// define an uninhabited stub type for boards without framebuffers
+#[cfg(not(any(feature = "board-baosec", feature = "board-baosor")))]
+pub trait FrameBuffer {}
 
 #[repr(C)]
 #[cfg(not(feature = "atsama5d27"))]
@@ -30,7 +36,7 @@ pub struct InitialProcess {
 /// We don't memorize the allocated results (in part because we don't have malloc/alloc to stick
 /// the table, and we don't know a priori how big it will be); we simply memorize the maximum extent,
 /// after which we allocate the book-keeping tables.
-pub fn phase_1(cfg: &mut BootConfig, detached_app: bool) {
+pub fn phase_1(cfg: &mut BootConfig, detached_app: bool, fb: Option<&mut dyn FrameBuffer>) {
     // Allocate space for the stack pointer.
     // The bootloader should have placed the stack pointer at the end of RAM
     // prior to jumping to our program. Reserve space for the stack, so that it does not smash
@@ -161,7 +167,7 @@ pub fn phase_1(cfg: &mut BootConfig, detached_app: bool) {
     // Copy the processes to RAM, if requested.
     if !cfg.no_copy {
         println!("Copying processes");
-        copy_processes(cfg);
+        copy_processes(cfg, fb);
     }
     // activate this to debug stack-smashing during copy_process(). The RPT is the first structure that gets
     // smashed if the stack overflows! It should be all 0's if the stack did not overrun.
@@ -499,9 +505,11 @@ impl TagType {
 
 /// Copy program data from the SPI flash into newly-allocated RAM
 /// located at the end of memory space.
-fn copy_processes(cfg: &mut BootConfig) {
+fn copy_processes(cfg: &mut BootConfig, mut _fb: Option<&mut dyn FrameBuffer>) {
     let mut _pid = 1;
-    for tag in cfg.args.iter() {
+    #[cfg(feature = "board-baosec")]
+    let arg_len = cfg.args.iter().count();
+    for (_i, tag) in cfg.args.iter().enumerate() {
         let tag_type = TagType::from(tag.name);
         match tag_type {
             TagType::IniF | TagType::IniE => {
@@ -879,6 +887,14 @@ fn copy_processes(cfg: &mut BootConfig) {
             }
             _ => {}
         }
+        #[cfg(feature = "board-baosec")]
+        if let Some(ref mut fb) = _fb {
+            let start = 5;
+            let end = 70;
+            let increment = (end - start) / arg_len;
+            let percentage = start + increment * _i;
+            crate::platform::progress_bar(*fb, percentage);
+        }
     }
 }
 

loader/src/phase2.rs

@@ -1,15 +1,20 @@
+#[cfg(any(feature = "board-baosec", feature = "board-baosor"))]
+use ux_api::minigfx::FrameBuffer;
 #[cfg(feature = "swap")]
 use xous::arch::{SWAP_CFG_VADDR, SWAP_COUNT_VADDR, SWAP_PT_VADDR};
 
 #[cfg(feature = "swap")]
 use crate::swap::*;
 use crate::{env::EnvVariables, *};
+// define an uninhabited stub type for boards without framebuffers
+#[cfg(not(any(feature = "board-baosec", feature = "board-baosor")))]
+pub trait FrameBuffer {}
 
 /// Phase 2 bootloader
 ///
 /// Set up all the page tables, allocating new root page tables for SATPs and corresponding
 /// sub-pages starting from the base of previously copied process data.
-pub fn phase_2(cfg: &mut BootConfig, env_variables: EnvVariables) {
+pub fn phase_2(cfg: &mut BootConfig, env_variables: EnvVariables, mut _fb: Option<&mut dyn FrameBuffer>) {
     let args = cfg.args;
 
     // This is the offset in RAM where programs are loaded from.
@@ -41,7 +46,9 @@ pub fn phase_2(cfg: &mut BootConfig, env_variables: EnvVariables) {
     #[cfg(feature = "bao1x")]
     trng.setup_raw_generation(32); // this is safe to call multiple times to affirm the TRNG state
 
-    for tag in args.iter() {
+    #[cfg(feature = "board-baosec")]
+    let arg_len = args.iter().count();
+    for (_i, tag) in args.iter().enumerate() {
         let mut env_header = crate::env::EnvHeader::default();
         #[allow(unused_mut)]
         let mut pid_env = env_variables.clone();
@@ -104,6 +111,14 @@ pub fn phase_2(cfg: &mut BootConfig, env_variables: EnvVariables) {
             }
             process_offset -= load_size_rounded;
         }
+        #[cfg(feature = "board-baosec")]
+        if let Some(ref mut fb) = _fb {
+            let start = 70;
+            let end = 95;
+            let increment = (end - start) / arg_len;
+            let percentage = start + increment * _i;
+            crate::platform::progress_bar(*fb, percentage);
+        }
     }
 
     println!("Done loading.");